fix(cdk/overlay): avoid leaking memory through afterNextRender

The `OverlayRef` was triggering an `afterEachRender` and passing in an `EnvironmentInjector`. Under the hood this uses a `DestroyRef` that is never destroyed, because the `EnvironmentInjector` is almost never destroyed.

These changes add an explicit `destroy` call to avoid the issue.

Fixes #29696.

Author: crisbeto

src/cdk/overlay/overlay-ref.ts

@@ -9,6 +9,7 @@
 import {Direction, Directionality} from '@angular/cdk/bidi';
 import {ComponentPortal, Portal, PortalOutlet, TemplatePortal} from '@angular/cdk/portal';
 import {
+  AfterRenderRef,
   ComponentRef,
   EmbeddedViewRef,
   EnvironmentInjector,
@@ -62,6 +63,9 @@ export class OverlayRef implements PortalOutlet {
   /** Stream of mouse outside events dispatched to this overlay. */
   readonly _outsidePointerEvents = new Subject<MouseEvent>();
 
+  /** Reference to the currently-running `afterNextRender` call. */
+  private _afterNextRenderRef: AfterRenderRef | undefined;
+
   constructor(
     private _portalOutlet: PortalOutlet,
     private _host: HTMLElement,
@@ -134,9 +138,14 @@ export class OverlayRef implements PortalOutlet {
       this._scrollStrategy.enable();
     }
 
+    // We need to clean this up ourselves, because we're passing in an
+    // `EnvironmentInjector` below which won't ever be destroyed.
+    // Otherwise it causes some callbacks to be retained (see #29696).
+    this._afterNextRenderRef?.destroy();
+
     // Update the position once the overlay is fully rendered before attempting to position it,
     // as the position may depend on the size of the rendered content.
-    afterNextRender(
+    this._afterNextRenderRef = afterNextRender(
       () => {
         // The overlay could've been detached before the callback executed.
         if (this.hasAttached()) {
@@ -250,6 +259,7 @@ export class OverlayRef implements PortalOutlet {
     this._outsidePointerEvents.complete();
     this._outsideClickDispatcher.remove(this);
     this._host?.remove();
+    this._afterNextRenderRef?.destroy();
 
     this._previousHostParent = this._pane = this._host = null!;